Qovex Company (“Controllers”)

Contact Information

Qovex Europe S.A., Luxembourg

[email protected]

UK:

USA:

Luxembourg:

Qovex Ltd,

Qovex Global Ltd, British Virgin Islands

Qovex US Inc, United States

Qovex UK Ltd.,

Qovex Financial Services d.o.o.

Registration of Individual Users

You need to create an Account prior to using the services provided by Qovex, which includes:

• Providing relevant Personal Data; and

• Confirming email and creating a password

• Exchange of email communication

If you are younger than 18 years or reside in countries where we do not offer services, you will not be able to register. While this is automated decision making, objection is not possible since this is a condition for usage of our services.

Personal Data

• Name

• Surname

• Email address

• Password

• Date of Birth

• Country of Residence

• IP Address

• Qovex User ID

Legal Basis

Contract/negotiation to conclude a contract

Onboarding and verification

Anti-money laundering and counter-terrorist financing legislation (“AML”) requires us to perform Customer Due Diligence prior to establishing a business relationship you. For this purpose:

• You will need to provide us with certain Personal Data and documentation to verify your identity,

• We will perform screening through online tools and crossmatch this data with data we hold for the purposes of compliance with AML (e.g. reputational information, financial information and business activities of corporate customers screening),

• We might initiate contact with you to finalize the onboarding or verification (e.g. to request additional documents from you).

Similar AML requirements exist for individuals acting on behalf of Corporate Users (directors, ultimate beneficial owners, authorized representatives etc.).

Personal Data

• Name

• Surname

• Address

• Country of Birth

• Place of Birth

• Country of Residence

• Nationality

• Tax Number

• KYC Questionnaire Answers

• Appropriateness Assessment

• IP Address

• Occupation

• Verification Documents

• ID Documents & information

• Picture / Videos (biometric data)

• Reports by background check providers

Scope of the Personal Data depends on the nature of individual and AML requirements for specific entity and risk factors.

Legal Basis

Compliance with legal obligation

Account Management & Updates

We will process certain Personal Data for the purpose of providing you with certain functionalities of your Account within the scope of provision of our services, including, but not limited to:

• Logging into the Account.

• Management of two factor authentication (“2FA”): setting, resetting, and removing 2FA.

• Forgotten password reset.

• Modification/deletion of data upon your request.

• Freezing your Account.

• Closing your Account.

• Deceased User Procedure.

For certain actions we might also require you to identify yourself, to prevent unauthorized access.

Personal Data

• Email

• Password

• 2FA key

• IP Address

• Any Data you wish to modify (*)

• Identification document

(*) Scope of Personal Data might depend on the operations you wish to conduct

Legal Basis

Contract (enabling functionalities of your account)

Transaction Management

You can conduct various transactions through your Account, including:

• Deposit/withdraw fiat or crypto assets.

• Trade with crypto (purchase and sell).

• Purchase & sale of financial instruments.

Performing transactions require processing of certain Personal Data, otherwise the transaction cannot be conducted.

In the event our services is accessed by you via our partner (e.g. Qovex as a Service), we may share with such partner additional information related to your request, as may be required to perform the service within the scope of the agreement between us and such partner.

Personal Data

• Name

• Surname

• Cardholder Data (Credit Card Number, Holder Name, Validity and CVC Code) *

• Transaction information

• Bank Account Information

• Withdrawal/Deposit Address Information

• Quote Preview Information, Quote, Account Balance, Transaction History(**)

Scope of information depends on the type of payment method you select.

(*) if you decide to deposit amounts / purchase crypto with credit card payment, the information is substituted by token, designated to keep your data secure. This information will not be stored by Qovex, but by our card payment service provider.

(**) This information is shared with our partner through which you utilize our services.  

Legal Basis

Contract (enabling functionalities of your account)

Transaction & Account Monitoring

AML requires us to conduct ongoing due diligence, including the scrutiny of your transactions, for example, to ensure consistency with the information you have provided us with during onboarding/verification. For these purposes, we:

• Have an internal monitoring system, based on which manual review may be requested,

• May whitelist withdrawal addresses,

• Apply what are known as ‘travel rule’ requirements by sending and receiving information from counterparty exchanges about you. Before sending crypto transfer to another exchange, we advise you to read their Privacy Policy to understand how they process your Personal Data.

• Monitoring Blockchain Transactions,

• Sharing certain information with banks through whom you have conducted a fiat transaction.

In addition to the above, we may require additional information or an explanation from you to comply with AML requirements.

Personal Data

• Transaction Information

• Name

• Surname

• Address

• Country of Birth

• Place of Birth

• Country of Residence

• Nationality

• KYC Questionnaire Answers

• Occupation

• Verification Documents

• ID Documents & information

• Picture / Videos (biometric data)

• Reports by background check providers

• Blockchain Transactions Reports.

• Computer or mobile device information (IP Address, operating system, network system, browser type and settings)

• Geolocation Information

• Website usage information

Scope of Personal Data collected or processed for this purpose depends on your activity, applicable AML requirements and other factors. 

Legal Basis

Compliance with legal obligation

Transaction & Price Alerts/Notifications

If you choose to receive transaction & price alerts or notifications about:

• Crypto or fiat withdrawals and deposits,

• Performed transactions,

• Price Alerts.

You give us consent to inform you about the requested information through SMS or email communication (based on your preferences). You can change your consent settings or price information at any time.

Personal Data

• Email

• Phone Number

• Transaction information

• Price Setting Alert Information

Scope of Personal Data depends on the type of communication you choose and scope of notification you require. 

Legal Basis

Consent

Complaints & Customer Support

At any time, you can initiate communication with us through any appropriate means of communication (email, support tickets, social media etc.) and we will process relevant Personal Data, the scope of which depends on your request, including for potential preparation of any documents requested by you.

For certain actions we might also require you to identify yourself to prevent unauthorized access.

Personal Data

• Any Personal Data processed by Qovex

Scope of Personal Data depends on the content of the complaint or required customer support. 

Legal Basis

Contract or Legal Obligation

Know Your Customer (“KYC”) Reliance

If you plan to use a certain Qovex Product or Service, it might be required that we share or receive your Personal Data with Qovex third-party providers of services (e.g. lending) or partners via which you access services provided by us. Such sharing will be made solely for the purposes of due diligence within the scope of AML requirements for the use of such a product or service. In the event you plan to conduct trading with derivates, Qovex Company to which you are onboarded (registered) will share required Personal Data with Qovex Financial Services d.o.o., which will provide you with the option of trading with derivates.

You will be notified about any such sharing before you start to use the relevant Qovex Product or Service in the applicable Terms of Use and will also receive a reference to that counterparty privacy notice, explaining how the counterparty will process your Personal Data as an independent Controller. 

Personal Data

• Name

• Surname

• Address

• Country of Birth

• Place of Birth

• Date of Birth

• Country of Residence

• Nationality

• Tax Number

• KYC Questionnaire Answers

• Appropriateness Assessment

• IP Address

• Occupation

• Verification Documents

• Contact Details

• ID Documents & information

• Picture / Videos (biometric data)

• Reports by background check providers

Scope of Personal Data depends on the nature of individual and AML requirements for specific entity and risk factors.

Legal Basis

Contract (enabling you use relevant products)

Qovex Connect & API Keys

If you decide to use Qovex Connect, you will need to provide your consent to share your Personal Data with integrator of your choice. On the consent form, you will receive information about types of Personal Data which will be shared, and the functionalities the integration will enable you to use, as well as a link to the Privacy Notice of the Integrator that will process your Personal Data as an independent Controller. The consent and integration will be valid for 180 days, after which you will have to re-consent. You can terminate the integration or withdraw your consent at any time.

If you choose to connect API Keys with your Account, Qovex does not have any information on which data you share and who is the recipient. Doing so is your responsibility. The responsibility of the recipient of this information is to comply with applicable Data Protection Laws.

When you decide to share your Personal Data with third parties we are not responsible and liable for any processing of Personal Data on their behalf or any actions performed on that third party site.

Personal Data

• Name

• Email address

• Crypto asset information

• Fiat assets information

• Trading orders

• Crypto Transfers

Scope of information depends on the integrator. You will be informed prior submitting your consent/agreeing sharing your data.

Legal Basis

Consent

Direct Marketing Communication (Email and Push Notifications)

We have a legitimate interest to promote our company, products, services or share other relevant information about us. For this purpose we will send you emails or share pop-up messages (which may be shown only when you are signed to your Account) with news, updates, promotions, market trends, or information about our new products and services. The processing will involve segmentation and analytics of whether you have seen/opened or acted on our direct marketing communication.

• You can object to this processing, by clicking on “unsubscribe link” which is included in every email communication.

In some cases we might send you direct marketing communications based on explicit consent you provide to us:

• Push notifications will be sent only if you granted us with explicit consent during the registration process, which can be at any time changed in the Account settings.

• Third party offers and some other communications from us will be sent only if you have given us explicit consent, which can be at any time changed in the Account settings.

Not all communication from us is direct marketing communication. This means communications may be for other purposes and can be conducted based on another legal basis. This means you will receive the communication regardless of whether you objected to the processing, or we don’t have valid consent.

Personal Data

• Name

• Surname

• Email Address

• Usage/Activity Information

• Country of Residence

• Transaction Information

• Information about held assets.

• Device information

Scope of Personal Data we will process depends on the type and scope of communication and legal basis used for processing of your Personal Data.  

Legal Basis

Legitimate Interest or Consent

Internal Analytics

We are constantly trying to improve our products and services and for this purpose we are processing certain Personal Data. Whenever possible the analysis is prepared based on pseudomized data to ensure your privacy is respected.

Personal Data

• Name

• Surname

• Email Address

• Usage/Activity Information

• Country of Residence

• Transaction Information

• Information about held assets.

• Device information

Scope of Personal Data we will process depends on the type and scope of communication and legal basis used for processing of your Personal Data.  

Legal Basis

Legitimate Interest or Consent

Control Operations

We may process your Personal Data for the purpose of prevention of fraud and financial crime, which includes development and improving of our anti-fraud systems, preventing, detecting, investigating, and prosecuting security threats, fraud, financial crimes, misconduct or other illegal or malicious activity and meeting our legal responsibilities

Personal Data

No additional data is collected. The scope of processing depends on the applicable requirements.

Legal Basis

Legitimate Interest or Legal Obligation

Ensuring & maintaining security

We are constantly trying to implement state-of-art security measures for the protection of our systems, your Personal Data and any assets you might have stored for us. For this purpose, we are required to process certain Personal Data, which is limited to what is required.

Personal Data

• Computer or mobile device information (IP Address, operating system, network system, browser type and settings)

• Geolocation Information

• Website usage information

• Any other data which might be required in specific cases

Legal Basis

Legitimate Interest to protect the information and assets

Reporting to authorities

We are subject to various legal obligations to report to the relevant authority’s information required within the scope of ongoing/periodical reporting or ad hoc requests received by such authorities. The scope of Personal Data depends on the requested information by the authority.

Personal Data

• Name

• Surname

• Customer Due Diligence Information

• Usage/Activity Information

• Transaction Information

• Information about held assets

• Other data requested by the Authority

Scope of Information depends on the authority’s request  

Legal Basis

Compliance with Legal Obligation

Legitimate Interest, in case the request is not mandatory but we decide to share the information regardless upon proper evaluation of the information.

Reporting to trade repositories

Under the European Market Infrastructure Regulation (EMIR), EU counterparties are required to report details of any derivative contract they have concluded, modified or terminated.

To ensure all derivate contracts that are subject to EMIR reporting obligation are properly reported, Qovex Financial Services d.o.o. will:

• report such derivate contracts and required data to the trade repositories on your behalf or on behalf of your counterparty; or

• provide MTF members with the information they need to report iin line with EMIR requirements.

Personal Data

• Unique ID of the counterparties

• Nature of counterparty

• Transaction and contract information

Legal Basis

Legitimate Interest

Pursuing, defending or assisting in any claims, litigation or other proceedings

In certain cases Qovex may be required to process your Personal Data for the purposes of pursuing, defending or assisting in any claim, litigation or other proceedings related to you and such data might be disclosed to external lawyers, courts or other administrative bodies.

Personal Data

• Name

• Surname

• Customer Due Diligence Information

• Usage/Activity Information

• Transaction Information

• Communication Information

• Other data required by a specific proceedings

Scope of Information depends on the type of claim, litigation or other proceeding and your role in relation to this.   

Legal Basis

Legitimate interest to pursue, define or assist in claims, litigation or other proceedings

Internal & External Audit

Qovex Companies are subject to legal requirements to appoint internal and/or external auditors in relation to various aspects of our compliance with applicable legislation. Auditors may request certain information which may identify you for the purposes of specific audit scope.

Personal Data

• Name

• Surname

• Customer Due Diligence Information

• Usage/Activity Information

• Transaction Information

• Communication Information

Scope of Information depends on the type of claim, litigation or other proceeding and your role in relation to this.   

Legal Basis

Compliance with Legal Obligation. 

Corporate Governance

In the fast-paced environment we are adjusting strategies based on regulatory and business requirements and processing of your Personal Data might be considered within this scope in the following cases:

• In the event of a different onboarding strategy: we might change the onboarding Qovex Company and thus transfer your Personal Data. In case this happens, we will notify you beforehand. The provisions of this Policy will continue to apply.

• In case of sale, merger or other corporate acquisition, Customers are important business asset, and such business transaction might also result in the transfer of your Personal Data, or making this information available to the prospective business partners/buyers. We will inform you of any major corporate changes.

Personal Data

• No additional collection of Personal Data

·        

Scope of Information depends on the type of claim, litigation or other proceeding and your role in relation to this.   

Legal Basis

Legitimate Interest

Right

Scope

Right of access

You can request confirmation of whether we process your Personal Data, a copy of your Personal Data and obtain information about how we process your Personal Data. You can read about this in this Policy or ask specific questions.

In case disclosure of information would reveal Personal Data of another individual, we may reject your request.

Right to correct/rectify

You can request correction/modification of incorrect or incomplete information.

We might still store your previous information for complying with applicable legislation.

Right to erasure/be forgotten

You can request deletion of your Personal Data, if it is no longer needed for the purposes for which it was collected/processed, you withdraw consent and there is no additional legal ground for processing, if there are no legitimate interests, the Personal Data is unlawfully processed or the erasure is required to comply with applicable legislation.

We will not delete/erase your data, if we need to process it to comply with applicable laws, or this is needed for the purpose of establishment, exercise, or defense of legal claims.

In addition, we might also not be able to fulfil your request if you still plan to use our services and plan to keep your account.

Right to restrict the processing

You can ask us to suspend the processing in certain circumstances (e.g. if you want to establish the accuracy of your Personal Data).

Personal Data will solely be used for the purpose of potential establishment, exercise or defense of legal claims or based on your consent.

Right to data portability

You have the right to receive the Personal Data, which you provided us, in a structured, commonly used and machine-readable format and have the right to transmit this data to another controller, if the processing is based on consent or contract and the processing is based by automated means.

Right to object

You have the right to object to the processing if the processing is based on legitimate interest. We will stop such processing unless we have compelling legitimate grounds for further processing, which overrides your interests, or we need processing for the purpose of establishment, exercise or defense of legal claims.

For processing of Personal Data for direct marketing purposes, you can object directly within such marketing communication, as explained above.

Right to automated individual decision making, including profiling.

You have the right not to be subject to automated individual decision making, including profiling, which produces legal effects concerning you or significantly affecting you.

This does not apply if the decision is necessary for entering, or performance of, a contract between you and us.

Right to withdraw consent

Where processing is based on consent, you have the right, at any time, to withdraw the consent.

Right to lodge complaint to supervisory authority

You have the right to lodge a complaint with the applicable supervisory authority, if you believe processing of your Personal Data is not compliant with Data Protection Laws.

-              European Union: If you are a resident of European Union or onboarded to Qovex Europe SA., you can lodge your complaint to Luxembourg data protection authority (Commission nationale pour la protection des données, Tel: 00352 26 10 60 1 or at www.cnpd.public.lu), which we consider as lead supervisory authority or to any other national authority in the field of data protection. If you use the services provided by Qovex, finančne storitve, d.o.o., you can lodge complaint to Information Commissionaire of Republic of Slovenia (https://www.ip-rs.si/), which Qovex, finančne storitve, d.o.o. consideres as lead supervisory authority or to any other national authority in the field of data protection.

-              : If you are a resident of the or onboarded to Qovex UK Limited, you can lodge your complaint to the UK’s Information Commissioner’s Office, Tel: 0044 1625 545 700 or at www.ico.org.uk

-              British Virgin Islands: If you are onboarded to Qovex Global Limited, you can lodge your complaint to the BVI Information Commissioner (+1(284) 468-3701 [email protected] )

Categories of Personal Data

Description

Do We Disclose for a Business Purpose?

Do We Sell?

Categories of Third Parties to Whom Personal Data is Sold or Disclosed

Identifiers

Includes direct identifiers, such as name, alias, user ID, username, account number or unique personal identifier; e-mail address, phone number, address and other contact information; IP address and other similar identifiers.

Yes

No

• service providers

• advisors and agents

• government entities and law enforcement

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Usage Data

Includes browsing history, clickstream data, search history, access logs and other usage data and information regarding an individual's interaction with our websites, and our marketing e-mails and online ads.

Yes

No

• service providers

• advisors and agents

• government entities and law enforcement

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Customer Records

Includes name, account name, user ID, contact information, and financial or payment information that individuals provide us in order to purchase or obtain our products and services.

Yes

No

• service providers

• advisors and agents

• government entities and law enforcement

• affiliates and subsidiaries

• data analytics providers

• operating systems and platforms

Commercial Information

Includes records of products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.

Yes

No

• service providers

• advisors and agents

• government entities and law enforcement

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Inferences

Includes inferences drawn from other personal information that we collect to create a profile reflecting an individual's preferences, characteristics, predispositions, behavior, attitudes, intelligence, abilities or aptitudes.

Yes

No

• service providers

• advisors and agents

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Audio, Video and Electronic Data

Includes audio, electronic, or similar information, such as photographs, images, and videos that you provide to us and call recordings.

Yes

No

• service providers

• advisors and agents

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Professional Information

Includes professional and employment-related information, such as current and former employer(s) and position(s) and business contact information.

Yes

No

• service providers

• advisors and agents

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

Biometric Information

Physiological, biological or behavioral characteristics that can be used alone or in combination with each other to establish individual identity.

Yes

No

• service providers

• advisors and agents

• affiliates and subsidiaries

• data analytics providers

• operating systems and platforms

Education Information

Includes professional and employment-related information.

Yes

No

• service providers

• advisors and agents

• affiliates and subsidiaries

• advertising networks

• data analytics providers

• social networks

• internet service providers

• operating systems and platforms

FACTS 

WHAT DOES BITSTAMP DO WITH YOUR PERSONAL INFORMATION? 

Why? 

Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do. 

What? 

The types of personal information we collect and share depend on the product or service you have with us. This information can include: 

• Social Security number;  

• Contact details and demographic information; 

• Account balances; 

• Account transactions 

• Transaction history; and 

• Payment history. 

When you are no longer our customer, we continue to share your information as described in this notice. 

How? 

All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial companies can share their customers’ personal information; the reasons Qovex chooses to share; and whether you can limit this sharing. 

Reasons we can share your personal information 

Does Qovex share? 

Can you limit this sharing? 

For our everyday business purposes — such as to process your transactions, maintain your account(s), or respond to court orders and legal investigations, or report to credit bureaus 

Yes 

No 

For our marketing purposes — to offer our products and services to you 

Yes 

No 

For joint marketing with other financial companies 

No 

We don’t share 

For our affiliates' everyday business purposes — information about your transactions and experiences 

Yes 

No 

For our affiliates' everyday business purposes — information about your creditworthiness 

No 

We don't share 

For our affiliates to market to you 

No 

We don't share 

For nonaffiliates to market to you 

No 

We don't share 

Questions? 

Check section Qovex Companies, Contact Information and Data Protection Officer(s) of the Privacy Policy

Who We Are 

Who is providing this notice? 

This notice is being provided on behalf of Qovex USA Inc and its affiliates. 

What We Do 

How does Qovex protect my personal information? 

To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These measures include computer safeguards and secured files and buildings. 
You are responsible for keeping your account passcode and user name safe and secure. Do not share those with anyone and update your password regularly. 

How does Qovex collect my personal information? 

We collect your personal information, for example, when you: 

• Open an Qovex account and provide relevant information for the use of Qovex services;  

• Deposit money to your account 

• Make from your account or otherwise use services provided by us; 

• Give us your income information and other information required within the scope of AML requirements; 

• Provide account information;  

• Give us your contact information; 

• Show your government issued ID. 

We may also collect your personal information from others, such as credit bureaus, affiliates, or other companies. 

Why can't I limit all sharing? 

Federal law gives you the right to limit only: 

• sharing for affiliates' everyday business purposes—information about your creditworthiness; 

• affiliates from using your information to market to you; and 

• sharing for nonaffiliates to market to you. 

State laws and individual companies may give you additional rights to limit sharing.  

Definitions 

Affiliates 

Companies related by common ownership or control. They can be financial and nonfinancial companies. Our affiliates include, but is not limited to: 

• Qovex Europe S.A. 

• Qovex Ltd 

• Qovex Global Ltd 

• Qovex UK Ltd 

• Qovex Asia Pte. Ltd 

• Qovex Luxembourg SARL 

• Qovex, storitve, d.o.o. 

• Qovex d.o.o. 

• Qovex, finančne storitve, d.o.o.

Nonaffiliates 

Companies not related by common ownership or control. They can be financial and nonfinancial companies. 

• Nonaffiliates we share with can include service providers such as data processors and banks.  

Joint Marketing 

A formal agreement between nonaffiliated financial companies that together market financial products or services to you. 

• Qovex doesn’t jointly market. 

Other Important Information